Unscored severity · published Jul 2, 2014
CVE-2014-4693
Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Pfsense · Netgate
through 2.1.4; 2.1.3 · source: NVD
SP
Snort Package · Pfsense
through 3.0.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4693
Vendor Advisory
https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc
More from Pfsense
9.8
CVE-2019-16915
An issue was discovered in pfSense through 2.4.4-p3
9.8
CVE-2019-12585
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php
9.6
CVE-2020-21487
Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of…
8.8
CVE-2025-12490
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability
8.8
CVE-2023-48123
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php…